Skip to main content
Attacks are organised into categories. Each category knows which recon signal justifies it and builds its own in-scope target lists, so the right tools run against the right hosts. Manual Attacks gives you each category’s pre-filled commands to run by hand; Automated Attacks runs the installed, runnable ones for you, stage by stage.

​
The categories

​
How targets are built

Each category reads the recon data that matters to it. Injection and XSS take the URLs that have parameters; TLS takes every TLS service; Takeover takes hostnames with dangling DNS; Cloud takes buckets named after the client; CMS takes hosts fingerprinted as a CMS. You are never pointing tools at the whole surface, only at the parts where that class of issue can exist.

​
Intrusive tools and safety

Tools that send real payloads (sqlmap, ghauri, commix, dalfox, wpscan, crlfuzz, the nuclei DAST pass and others) are intrusive and gated behind an explicit opt-in. Without it, Automated Attacks runs only the safe, non-intrusive checks. jwt_tool works offline by default, and Metasploit is always run by hand.
Only run attacks against systems you are authorized to test. Intrusive tools send live payloads and can change state on the target. Keep Evasive Mode on for sensitive engagements.